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INTRODUCTION 

Research and power reactors of various types are operating 
at present in the USSR. The new reactors that are being developed 
and built in our country like-wise differ widely in types and in 
specific design features. Evidently, the variety of reactor types 
will increase in the future • In this connection an urgent need 
arose for elaboration of general requirements which have to he 
accomplished in designing reactors and in selecting their 

operating conditions to provide maximum safety of reactor operati .i. 
On the other hand, whenever these requirements are deviated from 
(which is allowed as an exception only) special safety measures 
have to be taken, certain operating modes prohibited, etc. One of 
the most important problem that confronts the designers of nuclear 
reactor is the provision of nuclear safety, i.e. elaboration of a 
code of obligatory requirements and measures which would guarantee 
prevention of excessively quick or uncontrolled power excursion in 
a reactor. 

Elaboration of such general requirements was entrusted to the 
authors of this paper who prepared a draft of "Nuclear Safety Regula- 
tions For Power Reactors in the USSR". This paper contains these 
Regulations and a brief discussion. 
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IX • Nuclear Safety Regulations for Power Reactors in 

the USSR 

1* Provision of nuclear safety implies specific measures 
aimed at prevention of a quick or uncontrolled power runaway in 
a reactor. 

2. These Regulations are not valid for critical assemblies and 
pulsed reactors. 

3. In considering emergency situations account must be taken 
of the possible coincidence of two accidents one of which requires 
a long time (over an hour) to be explained or liquidated (sucli as 
cooling of the reactor). 

4. Regardless of their nature the accidents including the 

melting of the reactor must not result in reactor runaway* The 
shape, composition and quantity of the fissionable material must 
ensure double supply before criticality is attained. 

Changing of the reactor orientation in space, including 
tipping of mobile and transportable reactors (in transit) as well 
as sinking of a ship must in no way interfere with the operation 
of the units which shut down chain reaction. 

6. The effectiveness of the reactor safety units must be de- 
termined on the basis of the following considerations: 

a) if only one reactivity compensation element is provided, 
the safety elements, minus one, together with one half of the 
automatic regulator must cover the entire range of reactivity 
variation from the operating point to the point corresponding 

to the maximum reactivity on the reactivity versus temperature 
curve. 

b) if the number of the reactivity compensation elements with 
an operating time shorter than the emergency cooling time is more 
than one, the safety elements, minus one, must cover reactivity 
variation between the operating point and the temperature which the 
coolant has at the inlet to the reactor by the moment when further 
reactivity control can be effectively ensured by other control 
elements. In this case, the entire reactivity supply for the 
complete shut-down of the reactor must be provided by the reac- 
tion shut-down elements minus any one of them* 

’ BH . * 
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c) not less than two safety elements must be available. 

7. The safety system must provide safety signalling for the 
power increase period at least during tho start-up and transition 
to power operation. The operating ranges of the safety system with 
respect to power and period must overlap. The circuits of the power 
and period safety systems must contain at least two monitoring 
channels. 

8. It is forbidden to start up a reactor without at least two 
safety elements in the ready-to-operate position, the effective- 
ness of the safety elements must be not below ft , the effecti- 
veness of the safety system, minus one safety element, not below 

ft /2 • This requirement must be fulfilled no matter how the re- 
activity control system is displaced during operation after the 
reactor start-up, which includes the formation of local piles and 
xenon waves. The subcriticality of the reactor after the safety 
elements mentioned above and half of the automatic regulator are 
placed in the ready-tooperate position must be at least 0,5% of K^’. 

9. The safety elements must not depend for their operation on 
the provision of external power supplies. When two channels are 
used, signals from either channel must cause the safety system to 
operate. Not less than two properly operating safety channels must 
be provided at all times. 

10* The safety system must have provisions for checking the 
condition of the emergency signalling circuits - from the pick-ur 
to the actuator drives - during power operation without shutting 
down the reaction. The pick-up circuits must contain current or 
current unbalance indicators. 

11. The effectiveness of the automatic regulation rod must 
comply with one of the two requirements stated below: 
a; y^ar ~<ft 

b) at y^ ar yft the speed of the rod must be such that 
the reactivity ft is inserted at a uniform rate for a time period 
not smaller than 20 sec. At rhe same time, the following condition 
must be fulfilled: ft ft 33 the safety system elements minus 

one of them. 

Conditions (a) and (b) are not obligatory when there is a 
non- inertial effect (as compared to the travel time of the rod) 

38C 
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which covers the effectiveness of the automatic regulator. 

12. Per reactor riding up with periods corresponding to the 
operating speeds of the automatic regulator (second periods) the 
derivative & (t - temperature) must remain negative within a 
sufficiently large interval above and below the operating point. 

When the temperature coefficient within some temperature range 
is positive the maximum rate at which reactivity is inserted du- 
ring start-up or heat- up must be below the rate at which reactivi- 
ty is decreased by the motion of the automatic regulator. This 
limits the power during the heat-up. At the same time the safety 
elements, minus one of them, must cover the entire positive tempe- 
rature effect of reactivity variation. In case the reactivity 
control elements are inserted into the core in emergency situations 
(during the heat-up) they may be included for compensation of the 
positive temperature effect. 

13. No faults in the circuits and drives of the reactivity- 
control system must cause the reactivity to increase at a rate 
exceeding that specified in Point 10, b. Moreover, provisions must 
be made to stop insertion of reactivity whatever fault occurs in 
the circuits of the reactor reactivity control system. 

lh. The projects and the operating instructions for the ope- 
rating reactors must always contain sections on nuclear safety 
measures to be taken while carrying out maintenance and reloading 
of the reactor. 

15. To enable the comparison of the data relating to reactors 
types, the effectiveness of control and safety elements 
as well as the effectiveness of all physical processes taking place 
in the reactor must be calculated in terms of reactivity . The 
reactivity is found from the formula V (l -f>) s ^ ({) 

The formula (1) must be used to calculate the full reactivity 
supply of the reactor f* and all individual effects f The 
reactivity balance must be drawn up according to the formula 

TCI 

16* In each specific case, the scientific advisor and the chief 
designer of the reactor installation must submit well-grounded 
reasons for all deviations from the rules set forth in these Regu- 
lations; all such deviations must be approved by the State Commi- 
ssion for the Utilization of Atomic Energy. 
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Note; f denotes here the portion of the delayed neutrons 
for the given core. 

III. Discussion 

In accordance with their contents the Regulations can he 
divided into three unequal parts. The majority of the Points re- 
fer to the reactivity control system of a reactor and particu- 
larly to the safety system (Points 5 through 13). Besides, the 
Regulations specify the requirements to the reactor system proper 
(Points 4,5) and, finally, judicial and administrative points 
(1,2,14,15,1b). We will discuss each group in turn. 

Before starting the discussion of the problems connected 
with the reactivity control system we would like to emphasize 
Point 3 which stipulates the number of accidents in the reactor 
system. It is supposed that there may be two accidents simulta- 
neously, one of them being of a lengthy nature such as damage 
of the hermetic sealing of the reactor vessel or failure of some 
essential mechanism and the other, a short-time one, such as the 
failure of some control system or short-time interruption of power 
supply of some mechanism. It is assumed that emergency situations 
where several accidents occur simultaneously, which are more 
difficult and complicated than those described in Point 3 are 
practically non-existant and, therefore, should not be considered 
in designing reactors. This general assumption is also evident 
in paragraphs dealing with the reactivity control system of the 
reactor which consider the possibility that one absorbing rod or 
a group of absorbing rods actuated by a common drive may fail to 
operate to perform their immediate function. 

A high degree of reliability is required of the elements 
which shut down chain reaction. Therefore, Points 5 and 13 contain a 
a number of very stiff requirements which are quite self-explana- 
tory. It should be only noted that the second part of Point 13 
requires the provision of facilities which would enable the ope- 
rator controlling the installation to stop the increase of the 
reactivity whatever faults may appear in various systems. Point 9 
which calls for duplication of control stipulates a similar require- 
ment for the safety system. 
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Points 6 and 8 determine the required effectiveness of the 
safety system. It is assumed here that after the safety system 
operates the temperature of the coolant in the core will quickly 
settle at a value close to coolant temperature at the inlet to 
the core in power operation. Therefore, quick-acting devices, 
such as safety elements, are needed to compensate the additional 
reactivity. Further variation of the temperature in the core and 
the corresponding variation of the reactivity proceed much slower 
and can he compensated by the reactivity control elements having 
considerably slower speed of action. Besides, Point 8 stipulates 
that at any time during reactor operation provisions must be 
available to quickly decrease the system reactivity be an amount 
approximately equal to ft , should the reactivity suddenly 
increase at start-up or during operation. Attention is drawn to 
the fact that the effectiveness of the safety system is liable to 
be considerably affected by improper arrangement of the absorbers 
in the core or by the appearance of xenon oscillations. The Regu- 
lations stipulate the reactivity margin to be available until cri- 
ticality is reached after the safety elements are raised so as to 
minimize the dangerous effect of errors in preliminary evaluation 
of the system reactivity prior to the reactor start-up. Points 7 
and 10 formulate additional requirements to the safety system. 

The requirements of Point 10 stem from the fact that; separate 
drives used for the safety system are not checked for condition 
during long periods of time. All control circuits of the safety 
system either do not have any objective indications which would 
characterize their performance during operation of the reactor. 
Therefore, measures are defined which make it possible, at least 
partially, to remove this uncertainty - to check the control circui- 
ts of the safety system with the reactor operating. 

Point 11 indicates how the effectiveness of the automatic 
regulator must be selected so as to avoid quick power growth in 
the reactor at any displacement of the automatic regulation rods. 
When the reactor reactivity is increased by an amount for 

a period of 20 sec at a uniform rate, the reactor power doubles 
after L J sec. This gives sufficient time margin for the operator 

and for actuation of the safety system. 

<6r 
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Point 12 stipulates the necessity for self regulation of 
the core within the range of its operating temperatures and 
prescribes the procedure for starting the system and bringing it 
to normal operation when self -regulation is absent somewhere out- 
side the operating temperature range of the core. 

Of great importance for designing the reactors is Point 4 
which stipulates that the reactor design must ensure a 200% 
margin until the reactor goes critical as a result of core 
meltdown. In some cases this places considerable limitations on 
the construction of the lower reflector of the core and the spaces 
below it. 

We will not dwell on the judicial and administrative points 
which define the scope of application of the Regulations, re- 
quirements to record-keeping, etc. It should be only noted that 
the sole purpose of Point 15 is to ensure uniformity in evaluation 
of reactivity margin of various systems. 
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